go/oauth2-proxy
1
0
Fork 0
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git synced 2025-05-27 23:08:10 +02:00
Code Issues Releases Activity

Override groups on refresh even if empty

Browse Source
This commit is contained in:
Nick Meves 2021-07-02 22:47:08 -07:00
parent 51806c8433
commit 3b4e3415c8
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
providers/oidc.go
View File

@ -196,6 +196,11 @@ func replaceSession(s *sessions.SessionState, newSession *sessions.SessionState)
// If it doesn't it's probably better to retain the old one // If it doesn't it's probably better to retain the old one
if newSession.IDToken != "" { if newSession.IDToken != "" {
s.IDToken = newSession.IDToken s.IDToken = newSession.IDToken
// Override groups even if empty to prevent a user removed
// from all groups retaining access after refresh
// Only override if IDToken was present to set Groups.
s.Groups = newSession.Groups
} }
// Only copy over fields if they are present. Otherwise they might've // Only copy over fields if they are present. Otherwise they might've
@ -207,9 +212,6 @@ func replaceSession(s *sessions.SessionState, newSession *sessions.SessionState)
if newSession.User != "" { if newSession.User != "" {
s.User = newSession.User s.User = newSession.User
} }
if newSession.Groups != nil {
s.Groups = newSession.Groups
}
if newSession.PreferredUsername != "" { if newSession.PreferredUsername != "" {
s.PreferredUsername = newSession.PreferredUsername s.PreferredUsername = newSession.PreferredUsername
} }