public_git/oauth2-proxy
1
0
Fork 0
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git synced 2026-10-18 22:41:04 +02:00
Code Issues Projects Releases Wiki Activity

Auth and standard logging with file rolling

Browse Source
This commit is contained in:
MisterWil
2019-04-12 08:59:46 -07:00
parent ee4ebe53bf
commit 8ec025f536
23 changed files with 799 additions and 200 deletions
Download Patch File Download Diff File Expand all files Collapse all files
providers/azure.go
+3 -3
View File
@@ -3,12 +3,12 @@ package providers
import (
"errors"
"fmt"
"log"
"net/http"
"net/url"
"github.com/bitly/go-simplejson"
"github.com/pusher/oauth2_proxy/api"
"github.com/pusher/oauth2_proxy/logger"
)
// AzureProvider represents an Azure based Identity Provider
@@ -116,12 +116,12 @@ func (p *AzureProvider) GetEmailAddress(s *SessionState) (string, error) {
email, err = json.Get("userPrincipalName").String()
if err != nil {
log.Printf("failed making request %s", err)
logger.Printf("failed making request %s", err)
return "", err
}
if email == "" {
log.Printf("failed to get email address")
logger.Printf("failed to get email address")
return "", err
}
providers/github.go
+9 -8
View File
@@ -4,12 +4,13 @@ import (
"encoding/json"
"fmt"
"io/ioutil"
"log"
"net/http"
"net/url"
"path"
"strconv"
"strings"
"github.com/pusher/oauth2_proxy/logger"
)
// GitHubProvider represents an GitHub based Identity Provider
@@ -116,13 +117,13 @@ func (p *GitHubProvider) hasOrg(accessToken string) (bool, error) {
var presentOrgs []string
for _, org := range orgs {
if p.Org == org.Login {
log.Printf("Found Github Organization: %q", org.Login)
logger.Printf("Found Github Organization: %q", org.Login)
return true, nil
}
presentOrgs = append(presentOrgs, org.Login)
}
log.Printf("Missing Organization:%q in %v", p.Org, presentOrgs)
logger.Printf("Missing Organization:%q in %v", p.Org, presentOrgs)
return false, nil
}
@@ -179,7 +180,7 @@ func (p *GitHubProvider) hasOrgAndTeam(accessToken string) (bool, error) {
ts := strings.Split(p.Team, ",")
for _, t := range ts {
if t == team.Slug {
log.Printf("Found Github Organization:%q Team:%q (Name:%q)", team.Org.Login, team.Slug, team.Name)
logger.Printf("Found Github Organization:%q Team:%q (Name:%q)", team.Org.Login, team.Slug, team.Name)
return true, nil
}
}
@@ -187,13 +188,13 @@ func (p *GitHubProvider) hasOrgAndTeam(accessToken string) (bool, error) {
}
}
if hasOrg {
log.Printf("Missing Team:%q from Org:%q in teams: %v", p.Team, p.Org, presentTeams)
logger.Printf("Missing Team:%q from Org:%q in teams: %v", p.Team, p.Org, presentTeams)
} else {
var allOrgs []string
for org := range presentOrgs {
allOrgs = append(allOrgs, org)
}
log.Printf("Missing Organization:%q in %#v", p.Org, allOrgs)
logger.Printf("Missing Organization:%q in %#v", p.Org, allOrgs)
}
return false, nil
}
@@ -242,7 +243,7 @@ func (p *GitHubProvider) GetEmailAddress(s *SessionState) (string, error) {
resp.StatusCode, endpoint.String(), body)
}
log.Printf("got %d from %q %s", resp.StatusCode, endpoint.String(), body)
logger.Printf("got %d from %q %s", resp.StatusCode, endpoint.String(), body)
if err := json.Unmarshal(body, &emails); err != nil {
return "", fmt.Errorf("%s unmarshaling %s", err, body)
@@ -292,7 +293,7 @@ func (p *GitHubProvider) GetUserName(s *SessionState) (string, error) {
resp.StatusCode, endpoint.String(), body)
}
log.Printf("got %d from %q %s", resp.StatusCode, endpoint.String(), body)
logger.Printf("got %d from %q %s", resp.StatusCode, endpoint.String(), body)
if err := json.Unmarshal(body, &user); err != nil {
return "", fmt.Errorf("%s unmarshaling %s", err, body)
providers/gitlab.go
+3 -3
View File
@@ -1,11 +1,11 @@
package providers
import (
"log"
"net/http"
"net/url"
"github.com/pusher/oauth2_proxy/api"
"github.com/pusher/oauth2_proxy/logger"
)
// GitLabProvider represents an GitLab based Identity Provider
@@ -49,12 +49,12 @@ func (p *GitLabProvider) GetEmailAddress(s *SessionState) (string, error) {
req, err := http.NewRequest("GET",
p.ValidateURL.String()+"?access_token="+s.AccessToken, nil)
if err != nil {
log.Printf("failed building request %s", err)
logger.Printf("failed building request %s", err)
return "", err
}
json, err := api.Request(req)
if err != nil {
log.Printf("failed making request %s", err)
logger.Printf("failed making request %s", err)
return "", err
}
return json.Get("email").String()
providers/google.go
+8 -8
View File
@@ -8,12 +8,12 @@ import (
"fmt"
"io"
"io/ioutil"
"log"
"net/http"
"net/url"
"strings"
"time"
"github.com/pusher/oauth2_proxy/logger"
"golang.org/x/oauth2"
"golang.org/x/oauth2/google"
admin "google.golang.org/api/admin/directory/v1"
@@ -167,18 +167,18 @@ func (p *GoogleProvider) SetGroupRestriction(groups []string, adminEmail string,
func getAdminService(adminEmail string, credentialsReader io.Reader) *admin.Service {
data, err := ioutil.ReadAll(credentialsReader)
if err != nil {
log.Fatal("can't read Google credentials file:", err)
logger.Fatal("can't read Google credentials file:", err)
}
conf, err := google.JWTConfigFromJSON(data, admin.AdminDirectoryUserReadonlyScope, admin.AdminDirectoryGroupReadonlyScope)
if err != nil {
log.Fatal("can't load Google credentials file:", err)
logger.Fatal("can't load Google credentials file:", err)
}
conf.Subject = adminEmail
client := conf.Client(oauth2.NoContext)
adminService, err := admin.New(client)
if err != nil {
log.Fatal(err)
logger.Fatal(err)
}
return adminService
}
@@ -186,7 +186,7 @@ func getAdminService(adminEmail string, credentialsReader io.Reader) *admin.Serv
func userInGroup(service *admin.Service, groups []string, email string) bool {
user, err := fetchUser(service, email)
if err != nil {
log.Printf("error fetching user: %v", err)
logger.Printf("error fetching user: %v", err)
return false
}
id := user.Id
@@ -196,9 +196,9 @@ func userInGroup(service *admin.Service, groups []string, email string) bool {
members, err := fetchGroupMembers(service, group)
if err != nil {
if err, ok := err.(*googleapi.Error); ok && err.Code == 404 {
log.Printf("error fetching members for group %s: group does not exist", group)
logger.Printf("error fetching members for group %s: group does not exist", group)
} else {
log.Printf("error fetching group members: %v", err)
logger.Printf("error fetching group members: %v", err)
return false
}
}
@@ -274,7 +274,7 @@ func (p *GoogleProvider) RefreshSessionIfNeeded(s *SessionState) (bool, error) {
s.AccessToken = newToken
s.IDToken = newIDToken
s.ExpiresOn = time.Now().Add(duration).Truncate(time.Second)
log.Printf("refreshed access token %s (expired on %s)", s, origExpiration)
logger.Printf("refreshed access token %s (expired on %s)", s, origExpiration)
return true, nil
}
providers/internal_util.go
+7 -7
View File
@@ -2,11 +2,11 @@ package providers
import (
"io/ioutil"
"log"
"net/http"
"net/url"
"github.com/pusher/oauth2_proxy/api"
"github.com/pusher/oauth2_proxy/logger"
)
// stripToken is a helper function to obfuscate "access_token"
@@ -24,14 +24,14 @@ func stripToken(endpoint string) string {
func stripParam(param, endpoint string) string {
u, err := url.Parse(endpoint)
if err != nil {
log.Printf("error attempting to strip %s: %s", param, err)
logger.Printf("error attempting to strip %s: %s", param, err)
return endpoint
}
if u.RawQuery != "" {
values, err := url.ParseQuery(u.RawQuery)
if err != nil {
log.Printf("error attempting to strip %s: %s", param, err)
logger.Printf("error attempting to strip %s: %s", param, err)
return u.String()
}
@@ -57,18 +57,18 @@ func validateToken(p Provider, accessToken string, header http.Header) bool {
}
resp, err := api.RequestUnparsedResponse(endpoint, header)
if err != nil {
log.Printf("GET %s", stripToken(endpoint))
log.Printf("token validation request failed: %s", err)
logger.Printf("GET %s", stripToken(endpoint))
logger.Printf("token validation request failed: %s", err)
return false
}
body, _ := ioutil.ReadAll(resp.Body)
resp.Body.Close()
log.Printf("%d GET %s %s", resp.StatusCode, stripToken(endpoint), body)
logger.Printf("%d GET %s %s", resp.StatusCode, stripToken(endpoint), body)
if resp.StatusCode == 200 {
return true
}
log.Printf("token validation request failed: status %d - %s", resp.StatusCode, body)
logger.Printf("token validation request failed: status %d - %s", resp.StatusCode, body)
return false
}