public_git
/
oauth2-proxy
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
992 Commits 29 Branches 41 Tags 50 MiB
Commit Graph

992 Commits

Author SHA1 Message Date
Joel Speed 317f09f41e
Merge pull request #65 from lsst/jwt_bearer_passthrough 
JWT bearer passthrough
 2019-06-21 15:40:34 +01:00
Brian Van Klaveren 3881955605 Update unit tests for ValidateGroup 2019-06-20 16:57:20 -07:00
Brian Van Klaveren bd651df3c2 Ensure groups in JWT Bearer tokens are also validated 
Fix a minor auth logging bug
 2019-06-20 13:40:04 -07:00
Brian Van Klaveren 058ffd1047 Update unit tests for username 2019-06-17 13:11:49 -07:00
Brian Van Klaveren 5a50f6223f Do not infer username from email 2019-06-17 12:58:40 -07:00
Brian Van Klaveren 100f126405 Make JwtIssuer struct private 2019-06-17 12:52:44 -07:00
Brian Van Klaveren 2f6dcf3b5f Move refreshing code to block acquiring cookied session 2019-06-17 12:52:44 -07:00
Brian Van Klaveren 48dbb391bc Move around CHANGELOG.md update 2019-06-17 12:52:44 -07:00
Brian Van Klaveren 54d91c69cc Use logger instead of log 2019-06-17 12:52:13 -07:00
Brian Van Klaveren 350c1cd127 Use JwtIssuer struct when parsing 2019-06-17 12:52:13 -07:00
Brian Van Klaveren 58b06ce761 Fall back to using sub if email is none (as in PR #57) 2019-06-17 12:52:13 -07:00
Brian Van Klaveren 79acef9036 Clarify skip-jwt-bearer-tokens default and add env tags 2019-06-17 12:52:13 -07:00
Brian Van Klaveren 10f65e0381 Add a more realistic test for JWT passthrough 2019-06-17 12:52:13 -07:00
Brian Van Klaveren 1ff74d322a Fix imports 2019-06-17 12:52:13 -07:00
Brian Van Klaveren 69cb34a04e Add unit tests for JWT -> session translation 2019-06-17 12:52:13 -07:00
Brian Van Klaveren 187960e9d8 Improve token pattern matching 
Unit tests for token discovery
 2019-06-17 12:52:13 -07:00
Brian Van Klaveren 8413c30c26 Update changelog with info about -skip-jwt-bearer-tokens 2019-06-17 12:52:13 -07:00
Brian Van Klaveren b895f49c52 Use idToken expiry because that's the time checked for refresh 
RefreshSessionIfNeeded checks the token expiry, we want to use
the ID token's expiry
 2019-06-17 12:51:35 -07:00
Brian Van Klaveren 8083501da6 Support JWT Bearer Token and Pass through 2019-06-17 12:51:35 -07:00
Joel Speed 0af18d6d7c
Merge pull request #141 from openai/googleGroupEmail 
Check google group membership based on email address
 2019-06-15 14:05:56 +02:00
Joel Speed 77e1fff753
Merge pull request #185 from jonas/check-against-validate-url-string 
Only validate tokens if ValidateURL resolves to a non-empty string
 2019-06-15 12:30:03 +02:00
Joel Speed 0d6fa6216d
Merge pull request #180 from govau/littletidyups 
Minor restructure for greater confidence that only authenticated requests are proxied
 2019-06-15 12:21:54 +02:00
Joel Speed 6366690927
Fix gofmt for changed files 2019-06-15 11:34:00 +02:00
Joel Speed 417fde190c
Update changelog 2019-06-15 11:33:59 +02:00
Joel Speed fb9616160e
Move logger to pkg/logger 2019-06-15 11:33:58 +02:00
Joel Speed d1ef14becc
Move cookie to pkg/encryption 2019-06-15 11:33:57 +02:00
Adam Eijdenberg d69560d020 No need for case when only 2 conditions 2019-06-15 18:48:27 +10:00
Jonas Fonseca 7a8fb58ad1
Only validate tokens if ValidateURL resolves to a non-empty string 
Fix an unsupported protocol scheme error when validating tokens by
ensuring that the ValidateURL generates a non-empty string. The Azure
provider doesn't define any ValidateURL and therefore uses the default
value of `url.Parse("")` which is not `nil`.

The following log summary shows the issue:

    2019/06/14 12:26:04 oauthproxy.go:799: 10.244.1.3:34112 ("10.244.1.1") refreshing 16h26m29s old session cookie for Session{email:jonas.fonseca@example.com user:jonas.fonseca token:true} (refresh after 1h0m0s)
    2019/06/14 12:26:04 internal_util.go:60: GET ?access_token=eyJ0...
    2019/06/14 12:26:04 internal_util.go:61: token validation request failed: Get ?access_token=eyJ0...: unsupported protocol scheme ""
    2019/06/14 12:26:04 oauthproxy.go:822: 10.244.1.3:34112 ("10.244.1.1") removing session. error validating Session{email:jonas.fonseca@example.com user:jonas.fonseca token:true}
 2019-06-14 12:52:22 -04:00
Joel Speed 8027cc454e
Move api to pkg/requests 2019-06-08 07:40:43 +01:00
Adam Eijdenberg f35c82bb0f The AuthOnly path also needs the response headers set 2019-06-07 14:25:12 +10:00
Adam Eijdenberg 9e59b4f62e Restructure so that serving data from upstream is only done when explicity allowed, rather 
than as implicit dangling else
 2019-06-07 13:50:44 +10:00
Joel Speed 572646e0d5
Merge pull request #175 from govau/bumpoidc 
Bump go-oidc
 2019-06-06 17:54:25 +01:00
Joel Speed 78feaec6fa
Merge branch 'master' into bumpoidc 2019-06-06 17:38:19 +01:00
Joel Speed 55a853cf51
Merge pull request #155 from lsst/redis-session-store 
Redis session store
 2019-06-05 11:39:47 +01:00
Brian Van Klaveren 405f9b3bb0 Update CHANGELOG with descriptions about redis support 
Add updates from master
 2019-06-05 00:12:11 -07:00
Joel Speed 4721da02f2 Ensure SessionStores can handle recieving cookies for the wrong implementation 
(cherry picked from commit 131206cf41697543583751ac2714287898c19ad0)
 2019-06-05 00:11:42 -07:00
Joel Speed c1ae0ca807 Make sure the cookie exists before we clear the session in redis 
(cherry picked from commit 6d7f0ab57d554706425f76aed4df60717dd63ece)
 2019-06-05 00:11:42 -07:00
Joel Speed 22199fa417 Fix ticket retrieval with an invalid ticket 
(cherry picked from commit 66bbf146ec45d127bdd374120743aeef936894a7)
 2019-06-05 00:11:42 -07:00
Joel Speed 3155ada287 Ensure sessions are refreshable in redis session store 
(cherry picked from commit 48edce3003d187a3eadc4ea96236845271dd9360)
 2019-06-05 00:11:42 -07:00
Joel Speed 2e2327af6c Check SaveSession works when an existing session is present 
(cherry picked from commit 9dc1a96d817741632cb476456755a645b732db7d)
 2019-06-05 00:11:42 -07:00
Brian Van Klaveren ae0258a203 Documentation updates around Redis and Redis Sentinel use 2019-06-05 00:11:42 -07:00
Joel Speed 518c1d3e8e Add Redis sentinel compatibility 
(cherry picked from commit ff36b61f8cee4ecf0b91a90b5e1b651b526bb6b6)
 2019-06-05 00:11:42 -07:00
Brian Van Klaveren fc06e2dbef Update documentation and changelog for redis store 2019-06-05 00:11:42 -07:00
Joel Speed 5095c3647d Add redis-connection-url flag 2019-06-05 00:10:51 -07:00
Joel Speed 4f5dbace9f Refactor persistent tests with more Context 2019-06-05 00:10:51 -07:00
Joel Speed 7e7bfb5daf Stop miniredis after each test 2019-06-05 00:10:51 -07:00
Joel Speed bc3d75a2ed Run persistent tests with multiple option groups 2019-06-05 00:10:51 -07:00
Joel Speed 42f14a41d9 Clean up persistent SessionStore tests 2019-06-05 00:10:51 -07:00
Joel Speed a7693cc72a Tranfser all cookies in tests 2019-06-05 00:10:51 -07:00
Joel Speed 93df7d9132 Remove spurious comment 2019-06-05 00:10:51 -07:00