parent
e6e7c91352
commit
b5ebcb2a13
|
|
@ -25,11 +25,11 @@ import (
|
||||||
sessionsapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
|
sessionsapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
|
||||||
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/app/pagewriter"
|
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/app/pagewriter"
|
||||||
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/app/redirect"
|
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/app/redirect"
|
||||||
|
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/audit"
|
||||||
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/authentication/basic"
|
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/authentication/basic"
|
||||||
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/cookies"
|
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/cookies"
|
||||||
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/encryption"
|
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/encryption"
|
||||||
proxyhttp "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/http"
|
proxyhttp "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/http"
|
||||||
picsaudit "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/pics/audit"
|
|
||||||
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util"
|
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util"
|
||||||
|
|
||||||
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/ip"
|
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/ip"
|
||||||
|
|
@ -114,8 +114,7 @@ type OAuthProxy struct {
|
||||||
appDirector redirect.AppDirector
|
appDirector redirect.AppDirector
|
||||||
|
|
||||||
encodeState bool
|
encodeState bool
|
||||||
|
AuditClient *audit.Client
|
||||||
picsAuditClient *picsaudit.Client
|
|
||||||
}
|
}
|
||||||
|
|
||||||
// NewOAuthProxy creates a new instance of OAuthProxy from the options provided
|
// NewOAuthProxy creates a new instance of OAuthProxy from the options provided
|
||||||
|
|
@ -214,7 +213,7 @@ func NewOAuthProxy(opts *options.Options, validator func(string) bool) (*OAuthPr
|
||||||
Validator: redirectValidator,
|
Validator: redirectValidator,
|
||||||
})
|
})
|
||||||
|
|
||||||
picsAuditClient, err := picsaudit.NewAuditClient(&picsaudit.ClientOpts{
|
auditClient, err := audit.NewAuditClient(&audit.ClientOpts{
|
||||||
URL: opts.AuditURL,
|
URL: opts.AuditURL,
|
||||||
Enabled: opts.EnableAudit,
|
Enabled: opts.EnableAudit,
|
||||||
ProductName: opts.AuditProductName,
|
ProductName: opts.AuditProductName,
|
||||||
|
|
@ -257,7 +256,7 @@ func NewOAuthProxy(opts *options.Options, validator func(string) bool) (*OAuthPr
|
||||||
redirectValidator: redirectValidator,
|
redirectValidator: redirectValidator,
|
||||||
appDirector: appDirector,
|
appDirector: appDirector,
|
||||||
encodeState: opts.EncodeState,
|
encodeState: opts.EncodeState,
|
||||||
picsAuditClient: picsAuditClient,
|
AuditClient: auditClient,
|
||||||
}
|
}
|
||||||
p.buildServeMux(opts.ProxyPrefix)
|
p.buildServeMux(opts.ProxyPrefix)
|
||||||
|
|
||||||
|
|
@ -926,7 +925,7 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {
|
||||||
if !csrf.CheckOAuthState(nonce) {
|
if !csrf.CheckOAuthState(nonce) {
|
||||||
errorMsg := "Invalid authentication via OAuth2: CSRF token mismatch, potential attack"
|
errorMsg := "Invalid authentication via OAuth2: CSRF token mismatch, potential attack"
|
||||||
logger.PrintAuthf(session.Email, req, logger.AuthFailure, errorMsg)
|
logger.PrintAuthf(session.Email, req, logger.AuthFailure, errorMsg)
|
||||||
p.picsAuditClient.CreateFailedLoginAuditEntry(session, appRedirect, req.Header.Get("edisp-org-id"), errorMsg)
|
p.AuditClient.CreateFailedLoginAuditEntry(session, appRedirect, req.Header.Get("edisp-org-id"), errorMsg)
|
||||||
p.ErrorPage(rw, req, http.StatusForbidden, "CSRF token mismatch, potential attack", "Login Failed: Unable to find a valid CSRF token. Please try again.")
|
p.ErrorPage(rw, req, http.StatusForbidden, "CSRF token mismatch, potential attack", "Login Failed: Unable to find a valid CSRF token. Please try again.")
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
|
|
@ -955,7 +954,7 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {
|
||||||
p.ErrorPage(rw, req, http.StatusInternalServerError, err.Error())
|
p.ErrorPage(rw, req, http.StatusInternalServerError, err.Error())
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
p.picsAuditClient.CreateSuccessfulLoginAuditEntry(session, appRedirect, req.Header.Get("edisp-org-id"))
|
p.AuditClient.CreateSuccessfulLoginAuditEntry(session, appRedirect, req.Header.Get("edisp-org-id"))
|
||||||
http.Redirect(rw, req, appRedirect, http.StatusFound)
|
http.Redirect(rw, req, appRedirect, http.StatusFound)
|
||||||
} else {
|
} else {
|
||||||
logger.PrintAuthf(session.Email, req, logger.AuthFailure, "Invalid authentication via OAuth2: unauthorized")
|
logger.PrintAuthf(session.Email, req, logger.AuthFailure, "Invalid authentication via OAuth2: unauthorized")
|
||||||
|
|
|
||||||
|
|
@ -33,7 +33,7 @@ type Client struct {
|
||||||
func NewAuditClient(opts *ClientOpts) (*Client, error) {
|
func NewAuditClient(opts *ClientOpts) (*Client, error) {
|
||||||
if opts.Enabled {
|
if opts.Enabled {
|
||||||
log.Print("Audit entries will be created since OAUTH2_PROXY_ENABLE_AUDIT is true")
|
log.Print("Audit entries will be created since OAUTH2_PROXY_ENABLE_AUDIT is true")
|
||||||
err := opts.validate()
|
err := opts.Validate()
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, err
|
return nil, err
|
||||||
}
|
}
|
||||||
|
|
@ -154,7 +154,7 @@ func (c *Client) send(msg string) error {
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
|
||||||
func (c *ClientOpts) validate() error {
|
func (c *ClientOpts) Validate() error {
|
||||||
err := errors.New("")
|
err := errors.New("")
|
||||||
if strings.TrimSpace(c.URL) == "" {
|
if strings.TrimSpace(c.URL) == "" {
|
||||||
err = errors.New("the OAUTH2_PROXY_AUDIT_URL must be set")
|
err = errors.New("the OAUTH2_PROXY_AUDIT_URL must be set")
|
||||||
|
|
@ -81,7 +81,6 @@ type ExtensionContent struct {
|
||||||
URL string `json:"url,omitempty"`
|
URL string `json:"url,omitempty"`
|
||||||
ValueString string `json:"valueString,omitempty"`
|
ValueString string `json:"valueString,omitempty"`
|
||||||
}
|
}
|
||||||
|
|
||||||
type Extension struct {
|
type Extension struct {
|
||||||
URL string `json:"url,omitempty"`
|
URL string `json:"url,omitempty"`
|
||||||
Extension []*ExtensionContent `json:"extension,omitempty"`
|
Extension []*ExtensionContent `json:"extension,omitempty"`
|
||||||
Loading…
Reference in New Issue