public_git/oauth2-proxy
1
0
Fork 0
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git synced 2026-10-07 23:21:26 +02:00
Code Issues Projects Releases Wiki Activity
1,353 Commits 49 Branches 52 Tags
5b003a5657c7fdc489d2a2b3e05e25424be22fc2
Commit Graph
183 Commits
Author SHA1 Message Date
Nick Meves 26ed080bed Cleanup method name refactors missed in comments 2020-11-29 14:18:14 -08:00
Nick Meves 57a8ef06b4 Fix method renaming in comments and tests 2020-11-28 10:25:12 -08:00
Nick Meves 22f60e9b63 Generalize and extend default CreateSessionFromToken 2020-11-28 10:25:12 -08:00
Nick Meves 3e9717d489 Decouple TokenToSession from OIDC & add a generic VerifyFunc 2020-11-28 10:25:11 -08:00
Nick Meves e9f787957e Standardize provider interface method names 2020-11-28 10:25:11 -08:00
Nick Meves d7fa979060 Note legacy areas to refactor away from groupValidator 2020-11-12 11:18:59 -08:00
Nick Meves f21b3b8b20 Authorize in Redeem callback flow 2020-11-12 11:18:59 -08:00
Nick Meves 1b3b00443a Streamline ErrMissingCode in provider Redeem methods 2020-11-12 11:18:59 -08:00
Nick Meves b92fd4b0bb Streamline Google to use default Authorize 2020-11-12 11:18:58 -08:00
Nick Meves eb58ea2ed9 Move AllowedGroups to DefaultProvider for default Authorize usage 2020-11-12 11:18:15 -08:00
Nick Meves e7ac793044 Replace ValidateGroup with Authorize for Provider 2020-11-12 11:17:06 -08:00
Arcadiy Ivanov 45ae87e4b7 Logs provider name on startup 
If invalid provider is specified, stop and error out

fixes #895
 2020-11-12 10:39:35 -05:00
Alexander BlockandJoel Speed 0e119d7c84 Azure token refresh (#754) 
* Implement azure token refresh

Based on original PR https://github.com/oauth2-proxy/oauth2-proxy/pull/278

* Update CHANGELOG.md

* Apply suggestions from code review

Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>

* Set CreatedAt to Now() on token refresh

Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>
 2020-11-04 11:25:59 -08:00
Kevin KreitnerandNick Meves 65016c8da1 Enable custom structure for group claim with default name group (#839) 
* Allow complex structure for groups in group claim.

* Remove unused constant

* Update variable name

* Fix linting

* Use helper method

* Log error if not possible to append group value

* Add missing import

* Use own logger

* Fix imports

* Remove Dockerfile for testing

* Add Changelog entry

* Use formatGroup helper method and update tests

* Return string instead of string array

* Remove groups variable

* Return error in format method.

* Reorder imports

Co-authored-by: Nick Meves <nick.meves@greenhouse.io>
 2020-11-03 10:10:08 -08:00
Nick Meves 4a54c9421c Remove EmailDomain verification from GitLab provider 
This is handled globally
 2020-10-20 10:01:53 -07:00
Nick Meves d9c141ae7c Remove GetUserName method from Provider 2020-10-19 14:09:46 -07:00
Nick Meves 0da45e97e1 Refactor GitLab to EnrichSessionState 2020-10-19 14:09:45 -07:00
Nick Meves e51f5fe7c9 Refactor GitHub to EnrichSessionState 2020-10-19 14:09:45 -07:00
Nick Meves 2b9e1bbba0 Add EnrichSessionState as main post-Redeem session updater 2020-10-19 14:09:45 -07:00
Nick Meves 0bd8eb3191 Setup provider.ErrNotImplemented sentinel error 2020-10-19 14:09:02 -07:00
Mitsuo HeijoandJoel Speed 3fa42edb73 Fix import path for v7 (#800) 
* fix import path for v7

find ./ -name "*.go" | xargs sed -i -e 's|"github.com/oauth2-proxy/oauth2-proxy|"github.com/oauth2-proxy/oauth2-proxy/v7|'

* fix module path

* go mod tidy

* fix installation docs

* update CHANGELOG

* Update CHANGELOG.md

Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>

Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>
 2020-09-29 17:44:42 +01:00
Alexander Block 74918c40d8 Refactor makeLoginURL to accept extraParams 
And don't require the caller to know how to use the returned params.
 2020-09-28 12:15:06 +02:00
Alexander Block 4eb9612679 Move DefaultGetLoginURL into util.go 2020-09-28 12:15:06 +02:00
Alexander Block 9a64e67d5b De-duplicate code in GetLoginURL of in logingov provider 
Also add unit test to ensure logingov specific logic is applied.
 2020-09-28 12:15:06 +02:00
Alexander Block fde09bea4e Move azure specific resource parameter handling into azure provider 2020-09-28 12:15:06 +02:00
Alexander Block 97e95fd4ff Move actual implementation of default provider GetLoginURL into DefaultGetLoginURL 
This allows us to reuse code from different providers in case slight
modifications to the URL are needed.
 2020-09-28 12:15:06 +02:00
Alexander Block 017b9bcfb7 Add unit test for protected resources 2020-09-28 12:15:06 +02:00
Alexander Block 8cbf9219bc Pass resource parameter in login url 2020-09-28 12:15:06 +02:00
Nick Meves 3371284a36 Remove GetPreferredUsername method from Provider interface 
It isn't used in any providers and we have future plans
to remove the specialness of PreferredUsername and make it
an optional field in the session.

User, Email & Groups will eventually be the only first class
fields on the session that are always set.
 2020-09-24 10:49:50 -07:00
Stefan Sedich 9d59519a96 Add support to ensure user belongs in required groups when using the OIDC provider 2020-09-21 10:43:54 -07:00
Joel Speed d05e08cba3 Create generic Authorization Header constructor 2020-08-16 20:04:34 +01:00
Nick Meves 0645e19c24 Cleanup internalSession params & handle profileURL Bearer case better 
`findClaimsFromIDToken` would always have a `nil` access token and not be
able to hit the userinfo endpoint in Bearer case. If access token is nil,
default to legacy `session.Email = claim.Subject` that all JWT bearers used
to have, even if a valid profileURL is present.
 2020-08-14 13:31:38 -07:00
Nick Meves dcc75410a8 Handle claim finding differently in bearer vs standard IDTokens 2020-08-14 13:31:38 -07:00
Nick Meves 514db45d1a Allow OIDC Bearer Tokens without emails 
This reverts to functionality before #499 where an OIDC
provider could be used with `--skip-jwt-bearer-tokens` and
tokens without an email or profileURL would still be valid.
This logic mirrors `middleware.createSessionStateFromBearerToken`
which used to be the universal logic before #499.
 2020-08-14 13:31:38 -07:00
Phil TaproggeandJoel Speed d69fd6af22 Allow Logging to stdout with separate Error Log Channel (#718) 
* Add dedicated error logging writer

* Document new errors to stdout flag

* Update changelog

* Thread-safe the log buffer

* Address feedback

* Remove duplication by adding log level

* Clean up error formatting

* Apply suggestions from code review

Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>
 2020-08-10 11:44:08 +01:00
Nick Meves ad52587ae6 Document GoSec nosec skip comments 2020-08-09 07:55:40 -07:00
Nick Meves 65c228394f Address gosec findings 
Mostly handling unhandled errors appropriately.
If logging to STDERR fails, we panic. Added #nosec
comments to findings we are OK with.
 2020-08-09 07:55:39 -07:00
Joel Speed d4dd34a65a Move provider URLs to package level vars 2020-07-19 18:34:55 +01:00
Joel Speed eb234011eb Integrate sessions middlewares 2020-07-19 17:24:12 +01:00
Joel Speed de9e65a63a Migrate all requests to result pattern 2020-07-06 20:38:00 +01:00
Joel Speed 53142455b6 Migrate all requests to new builder pattern 2020-07-06 18:31:09 +01:00
İlteriş EroğluandJoel Speed 1b6c54cae1 Change how gitlab-group is parsed on options (#639) 
* Changed how gitlab-group is parsed, from string to []string

See #637

* Point out that gitlab-group can be a list

See #637

* Reflect to the []string change on pkg/apis/options/options.go

See #637

* Move cfg option gitlab_group to gitlab_groups

See #637

* Renamed Group to Groups

See #637

* Reflect the change on gitlab.go as well

See #637

* Added #639

* Added the author of #639 to the CHANGELOG

* Add the gitlab_groups env change to CHANGELOG.md

See #639

Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>

Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>
 2020-06-26 23:26:07 +01:00
Nick Meves a3eef1709a Improve default CreateSessionStateFromBearerToken tests 2020-06-19 11:48:23 -07:00
Nick Meves c2c1caa404 Set User = Subject in ExtraJWTBearer sessions 2020-06-19 11:48:23 -07:00
Nick Meves 788d8ecc1b Verify main v extra JWT bearers differently 
When using the configured provider JWT Verifier, it makes
sense to use the provider `CreateSessionStateFromBearerToken`
method. For any extra JWT Issuers, they should use a generic
default verifier.
 2020-06-19 11:47:36 -07:00
Joel SpeedandHenry Jenkins 160bbaf98e Fallback to UserInfo is User ID claim not present (#560) 
Co-authored-by: Henry Jenkins <henry@henryjenkins.name>
 2020-06-04 17:41:29 +01:00
Scott Guymer 3aeca4368c ACR values should not be automatically added when blank (#598) 
* ACR values should not be automatically added when blank

* Added changelog
 2020-06-02 18:17:27 +01:00
Yoshiki NakagawaandJoel Speed d8d43bb51b Support new option "github-user" (#421) 
* feat(github): support new option "github-user"

* feat(github): rename github-user to github-users

* feat(github): update docs for github-users option

* feat(github): remove unneeded code

* feat(github): remove logging

* feat(github-user): use github-user as flagset options

* feat(github-user): remove optionns.go

* feat(github-user): add github-user flagset

* feat(github): improve readability in the docs

* feat(github-user): refactored SetUsers method

* Update flag description

Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>
 2020-06-01 20:02:07 +01:00
Joel SpeedandHenry Jenkins f7b28cb1d3 Improvements to Session State code (#536) 
* Drop SessionStateJSON wrapper
* Use EncrpytInto/DecryptInto to reduce sessionstate

Co-authored-by: Henry Jenkins <henry@henryjenkins.name>
 2020-05-30 08:53:38 +01:00
Nick Meves d228d5a928 Refactor the utils package to other areas (#538) 
* Refactor the utils package to other areas

Move cookieSession functions to cookie session store
& align the double implementation of SecretBytes to be
united and housed under encryption

* Remove unused Provider SessionFromCookie/CookieForSession

These implementations aren't used, these are handled in the cookie store.

* Add changelog entry for session/utils refactor
 2020-05-14 10:16:35 +01:00