Commit Graph

298 Commits

Author SHA1 Message Date
Kevin Kreitner 203f42e660
Merge branch 'master' into add-cidaas-provider 2025-07-29 09:12:35 +02:00
Sourav Agrawal e75a258299
feat: make google-groups argument optional (#3138)
add test cases

update documentation

refactor code and some cleanup

update changelog

Signed-off-by: Jan Larwig <jan@larwig.com>
2025-07-24 07:55:54 +02:00
Michael Cornel b905f2cd93
feat: use non-default authorization request response mode in OIDC providers (#3055)
* fix: OIDC sets response mode

* Update CHANGELOG
2025-07-23 22:40:12 +02:00
Conrad Hoffmann a88306be98
feat: add SourceHut (sr.ht) provider (#2359)
* Add SourceHut (sr.ht) provider

* fix changelog entry

Signed-off-by: Jan Larwig <jan@larwig.com>

---------

Signed-off-by: Jan Larwig <jan@larwig.com>
Co-authored-by: Jan Larwig <jan@larwig.com>
2025-07-22 08:16:32 +02:00
Kevin Kreitner e9924c3f62
Merge branch 'master' into add-cidaas-provider 2025-07-21 14:50:05 +02:00
Bob Du 4d17bc1d68
feat: allow use more possible google admin-sdk api scopes (#2743)
* feat: Allow use more possible google admin-sdk api scopes.

* reduce cognitive complexity

Signed-off-by: Bob Du <i@bobdu.cc>

* remove unnecessary else block / indentation

Signed-off-by: Jan Larwig <jan@larwig.com>

* add changelog entry

Signed-off-by: Jan Larwig <jan@larwig.com>

* slight formatting and error message rephrasing

Signed-off-by: Jan Larwig <jan@larwig.com>

---------

Signed-off-by: Bob Du <i@bobdu.cc>
Signed-off-by: Jan Larwig <jan@larwig.com>
Co-authored-by: Jan Larwig <jan@larwig.com>
2025-07-21 09:06:17 +02:00
Kevin Kreitner 61d82780e5
Fix linting 2025-07-16 21:16:20 +02:00
Kevin Kreitner 1441449b81
Fix tests 2025-07-16 21:16:20 +02:00
Kevin Kreitner 5ee1951f03
Add import for provider options 2025-07-16 21:16:19 +02:00
Kevin Kreitner 652d16692d
Pass provider options to Cidaas provider
Co-authored-by: Jan Larwig <jan@larwig.com>
2025-07-16 21:16:19 +02:00
Kevin Kreitner de787a2948
Directly handle returned error
Co-authored-by: Jan Larwig <jan@larwig.com>
2025-07-16 21:16:19 +02:00
Kevin Kreitner 919d491cdc
Use less deep nesting
Co-authored-by: Jan Larwig <jan@larwig.com>
2025-07-16 21:16:18 +02:00
Kevin Kreitner 4fb6043b04
Directly handle error return
Co-authored-by: Jan Larwig <jan@larwig.com>
2025-07-16 21:16:18 +02:00
Teko012 00a83f01be
Adjust provider sorting, fixes 2025-07-16 21:16:16 +02:00
Kevin Kreitner 7dfbf3b940
Fix linting 2025-07-16 21:15:47 +02:00
Kevin Kreitner 15b23228e1
Remove if block with protected resource 2025-07-16 21:15:46 +02:00
Kevin Kreitner 7bbe01fe97
Fix tests 2025-07-16 21:15:46 +02:00
Kevin Kreitner 58bc09833e
Add required groups scope to defaults 2025-07-16 21:15:46 +02:00
Kevin Kreitner 43f0ee6791
Add Cidaas provider 2025-07-16 21:15:12 +02:00
Daniel Mersch 7731437af4
feat: support for multiple github orgs (#3072)
* fix for github teams

* Update github.go

* added errorhandling

* Update github.md

* refactored GitHub provider

refactored hasOrg, hasOrgAndTeams and hasTeam into hasAccess to stay within function limit

* reverted Refactoring

* refactored github.go

- joined hasOrgAndTeamAccess into checkRestrictions

* refactored github.go

- reduced number of returns of function checkRestrictions to 4

* updated GitHub provider to accept legacy team ids

* GoFmt and golangci-lint

Formatted with GoFmt and followed recommendations of GoLint

* added Tests

added Tests for checkRestrictions.

* refactored in maintainer feedback

* Removed code, documentation and tests for legacy ids

* add changelog and update docs

---------

Signed-off-by: Jan Larwig <jan@larwig.com>
Co-authored-by: Jan Larwig <jan@larwig.com>
2025-05-29 18:11:07 +02:00
Olivier Mengué 1225d611e9
chore(lint): fix staticcheck issues (#3061)
* chores: fix staticcheck QF1012

Fix use of fmt.Sprintf when writing to a writer.
https://staticcheck.dev/docs/checks/#QF1012
https://github.com/oauth2-proxy/oauth2-proxy/issues/3060

* chores: fix staticcheck QF1003

Use switch instead of multiple if/else.
https://staticcheck.dev/docs/checks/#QF1003
https://github.com/oauth2-proxy/oauth2-proxy/issues/3060

* chores: exclude staticcheck QF1008 for now

We aim to migrate golangci-lint to v2
Let's disable QF1008 (Omit embedded fields from selector expression)
for now.
https://staticcheck.dev/docs/checks/#QF1008

* chores: fix golangci config: run.deadline -> timeout

Rename config option to match v1 documentation: deadline -> timeout.
https://golangci.github.io/legacy-v1-doc/usage/configuration/#run-configuration

This error has been spotted by golangci-lint v2 migration tool.

* chores: fix staticcheck QF1012
2025-05-26 12:29:34 +02:00
Olivier Mengué 09f6252ebf
chore(deps): drop golang.org/x/exp/{slices,maps} (#3065)
Use Go 1.23 stdlib instead: slices, maps.
2025-05-26 12:20:49 +02:00
Guillaume "Elektordi" Genty 7b41c8e987
fix: role extraction from access token in keycloak oidc (#1916)
* Fix wrong token used in Keycloak OIDC provider

* Update CHANGELOG for PR #1916

* Update tests

* fix: keycloak oidc role extraction

---------

Co-authored-by: Jan Larwig <jan@larwig.com>
2025-04-28 10:23:19 +01:00
Richard Hagen 7d85c99d8e
fix(entra-id): use federated credentials for refresh token (#3031)
* fix: use federated credentials to refresh token in entra id

* fix: add some error handling

* chore: update changelog

* chore: update comments

* chore: update comments

* doc: reference entra id docs and clearer phrasing of comments

Signed-off-by: Jan Larwig <jan@larwig.com>

---------

Signed-off-by: Jan Larwig <jan@larwig.com>
Co-authored-by: Jan Larwig <jan@larwig.com>
2025-04-25 09:59:09 +02:00
Michael Cornel f6b95c0df8
feat: allow to set non-default authorization request response mode (#3001)
* Update Go version in devcontainer

* Add option to change response mode in authorization request

* Fix option name

* Update docs and changelog

* Rename config value to underscore

* Add unit tests for added parameter

* Move change to upcoming release

* Generate alpha config

---------

Co-authored-by: Michael Cornel <michael@stieler.it>
2025-03-31 10:04:19 +02:00
Jan Larwig 67f3da232a fix(test): syntax violation of json with one too many closing curly brackets 2025-01-20 20:45:45 +01:00
axel7083 e28603f7af
feature: static public keys file support for oidc provider
Co-authored-by: Jan Larwig <jan@larwig.com>
Co-authored-by: JJ Łakis <jacek.lakis@checkatrade.com>
2025-01-11 12:09:23 +00:00
JJ Łakis ae8fb08a89
feat(entra): add Workload Identity support for Entra ID (#2902) 2025-01-11 11:12:41 +00:00
Joel Speed f41a686b43
Fix linting after updating golangci-lint to 1.62.2 2024-12-31 13:14:39 +01:00
JJ Łakis 5f188e5b6b
Microsoft Entra ID provider (#2390)
* Microsoft Entra ID Provider

* fix typo in function name

* documentation tweaks

* documentation and comment tweak

* docs tweaks

* final tweaks

* refactor: drop flag for skipping graph groups

* update legacy / deprecated provider page and sort provider overview

* reformat

* move entra-id provider into switch (treat like every other provider

* fix test case and reformat

* fix sidebar configuration

* apply review suggestions

* add pagination for graph api

* fix: do not error when groups unable to retrieve

* doc: number of groups fix

* restore master packages

* docs: tiny docs tweak

* address review comments

* fix codegen

---------

Co-authored-by: tuunit <jan@larwig.com>
2024-12-31 11:46:13 +00:00
Jacek J. Łakis 05b91f310a chore: extend test cases for oidc provider and documentation regarding implicit setting of the groups scope when no scope was specified in the config
Co-authored-by: Jan Larwig <jan@larwig.com>
2024-11-09 15:48:29 +01:00
tuunit 41c8d5bfce chore(deps): update all golang dependencies 2024-09-23 16:38:40 +02:00
Koen van Zuijlen 343bd61ebb
chore(deps): Updated to ginkgo v2 (#2459)
* chore(deps): Updated to ginkgo v2

* fix basic auth test suite cleanup

* fix redis store tests

* add changelog entry

---------

Co-authored-by: Jan Larwig <jan@larwig.com>
2024-07-18 22:41:02 +02:00
Jacob Middag 3045392c17
feat: Replace default Go user-agent with oauth2-proxy and version (#2570)
* feat: Replace default Go user-agent with oauth2-proxy and version

* Add to CHANGELOG

* Make userAgentTransport configurable and composable

* Use correct naming convention for DefaultHTTPClient

* Move version to own package and use named arguments

* Update version path in Makefile

* Fix import path in Makefile

* Change importpath in dist.sh

* Minor style issues
2024-07-14 21:09:17 +01:00
kvanzuijlen f8efdbae5f
chore: Updated go-jwt to v5 2024-03-04 01:42:00 +01:00
Damien Degois e7d20519df
Session aware logout, backend logout url approach (#1876)
* Session aware logout, backend logout url approach

* Add CHANGELOG.md and documentation for #1876

* Proper http handling and case change for golint compliance

* Update alpha_config.md

* Fix case conformity

* Change placeholder from ${id_token} to {id_token}

As this should be specified in a URL and curly braces should be escaped as %7b and %7d, therefore using {} shouldn't be an issue

* Apply suggestions from code review

Co-authored-by: Jan Larwig <jan@larwig.com>

* Add other suggestions

* Add suggestions and move background logout to generic provider

* Changelog updated

* Update oauthproxy.go

Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>

* Add comment for gosec, remove sensitive data from log

---------

Co-authored-by: Jan Larwig <jan@larwig.com>
Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>
2024-01-26 12:48:09 +00:00
Jan Larwig 5e68dad636
upgrading to go 1.21 (#2235)
* chore: bump go to version 1.21

update all depedencies as well

* fix linting issues based on golang 1.20 deprecations

* cleanup go depedencies

* add custom gomega matcher for option intefaces

* revert and upgrade golangci-lint to 1.55.2

* fix lint issues for v1.55.2 of golangci-lint

* fix toml loading test

* remove second runspecs call

* update go.sum

* revert testutil package
2024-01-22 13:39:53 +00:00
Nils Gustav Stråbø 4c2bf5a2fe
Feature/add option to skip loading claims from profile url (#2329)
* add new flag skip-claims-from-profile-url

* skip passing profile URL if SkipClaimsFromProfileURL

* docs for --skip-claims-from-profile-url flag

* update flag comment

* update docs

* update CHANGELOG.md

* Update providers/provider_data.go

Co-authored-by: Jan Larwig <jan@larwig.com>

* Add tests for SkipClaimsFromProfileURL

* simplify tests for SkipClaimsFromProfileURL

* generate alpha_config.md

---------

Co-authored-by: Jan Larwig <jan@larwig.com>
2024-01-20 19:51:42 +00:00
darh bfd667e4a2
Update go-jose dependency as requested in #2350 (#2356)
* update go-jose dependency by switching gopkg.in/square/go-jose.v2
with github.com/go-jose/go-jose/v3

* updated `CHANGELOG.md` with entry for PR #2356

---------

Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>
2024-01-08 13:08:35 +00:00
Jan Larwig 52ad31752d
Feature: Add GitHub groups (orgs/teams) support (#2196)
* Add GitHub groups (orgs/teams) support

* align code of getTeams with getOrgs to support Github Enterprise Server instances with different domain

* add documentation

* add missing import after rebase

* add nightly build and push (#2297)

* add nightly build and push

* add date based nightly build tags

* only keep single multiarch image build and push

* add changelog

* add images to internal docs static files

* add docu for nightly builds

* remove unnecessary spaces

* update nightly repository

* Issue 978: Fix Custom cookie name breaks redis for session (#1949)

* Issue 978: Fix Custom cookie name breaks redis for session (see https://github.com/oauth2-proxy/oauth2-proxy/issues/978)

* Issue 978: Fix Custom cookie name breaks redis for session (see https://github.com/oauth2-proxy/oauth2-proxy/issues/978)

* Update CHANGELOG.md

* Issue 978: Fix Custom cookie name breaks redis for session

* Issue 978: Fix Custom cookie name breaks redis for session

* Issue 978: Fix Custom cookie name breaks redis for session

* Issue 978: Fix Custom cookie name breaks redis for session

* Issue 978: Fix Custom cookie name breaks redis for session

* Issue 978: Fix Custom cookie name breaks redis for session

* Update CHANGELOG.md

---------

Co-authored-by: Nuno Borges <Nuno.Borges@ctw.bmwgroup.com>
Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>

* Support http.AllowQuerySemicolons (#2248)

* Support http.AllowQuerySemicolons

* Docs

* Make it clear we are overriding the handler

* Update documentation for allow-query-semicolons

* Fix changelog format

* Fix formatting

---------

Co-authored-by: MickMake <github@mickmake.com>

* Add GitHub groups (orgs/teams) support

* align code of getTeams with getOrgs to support Github Enterprise Server instances with different domain

* add documentation

* fix changelog & documentation

* fix missing import

---------

Co-authored-by: Tobias Mayer <github@tobiasm.de>
Co-authored-by: Nuno Miguel Micaelo Borges <miguelborges99@gmail.com>
Co-authored-by: Nuno Borges <Nuno.Borges@ctw.bmwgroup.com>
Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>
Co-authored-by: Tim White <tim.white@su.org.au>
Co-authored-by: MickMake <github@mickmake.com>
2023-12-18 10:03:19 +00:00
Jan Larwig fc6e7fdbd1
bugfix: OIDCConfig based providers are not respecting flags and configs (#2299)
* add full support for all oidc config based providers to use and respect all configs set via OIDCConfig

* add changelog entry

---------

Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>
2023-11-25 11:32:31 +00:00
Markus Blaschke 66bfd8ebd5
add azure china support (#2269)
* add azure china support

Signed-off-by: Markus Blaschke <mblaschke82@gmail.com>

* update changelog

Signed-off-by: Markus Blaschke <mblaschke82@gmail.com>

* fix lint

Signed-off-by: Markus Blaschke <mblaschke82@gmail.com>

---------

Signed-off-by: Markus Blaschke <mblaschke82@gmail.com>
Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>
2023-11-01 10:12:34 +00:00
Joel Speed 48247d3e79
Merge pull request #2283 from kvanzuijlen/golint
Updated linters
2023-10-25 11:36:44 +01:00
Koen van Zuijlen 464f3bcf53
Fixed Google ADC functionality (#2282)
* Fixed Google ADC functionality

* Updated CHANGELOG.md

* Redo changes after merge-conflict

* Fixed docs

* Fixed linting issues

* Applied PR suggestions
2023-10-24 20:03:16 +01:00
kvanzuijlen e13a5048eb Updated linters 2023-10-24 16:37:57 +02:00
Jan Larwig 13af1b4786
fix gitea token validation by allowing custom validation url and extracting the proper base api url for github cloud, github enterprise and gitea (#2194) 2023-09-14 10:09:57 +01:00
tuunit 7683902a42 bugfix: default scopes for OIDCProvider based providers 2023-09-10 20:10:14 +00:00
Jan Larwig 6f6039c82b bugfix: move oidc scope logic to oidc provider 2023-09-08 05:35:41 +00:00
Koen van Zuijlen a6e8ec81e8
Workload identity support (#2126)
* WIP: support for workload identity

* WIP: bugfixes to support WI

* Added support for Workload Identity

* Added missing flag

* Refactoring and typo

* Updated CHANGELOG.md

* Updated docs

* Updated changelog

* Improved readability and fixed codeclimate issues

* Update CHANGELOG.md

Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>

* Fixed if statement

* Apply suggestions from code review

Co-authored-by: Jan Larwig <jan@larwig.com>

* Cleanup

* Removed target principal

* Removed references to target principal

* Added docs

* Fixed header anchor linking

* Update auth.md

* Updated generated code

* Improved code

* Fixed tests

---------

Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>
Co-authored-by: Jan Larwig <jan@larwig.com>
2023-09-04 10:34:54 +01:00
Nuno Miguel Micaelo Borges cbc973c8d9
Issue 1878: Validate URL call does not correctly honor already set UR… (#1951)
* Issue 1878: Validate URL call does not correctly honor already set URL parameters

* Issue 1878: Validate URL call does not correctly honor already set URL parameters

* Update CHANGELOG.md

---------

Co-authored-by: Nuno Borges <Nuno.Borges@ctw.bmwgroup.com>
Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>
2023-02-10 18:36:13 +00:00