From 95dd2745c7f0d0de3812478f2dc49768042af2cc Mon Sep 17 00:00:00 2001 From: Joel Speed Date: Tue, 15 Feb 2022 11:07:13 +0000 Subject: [PATCH] Remove options dependency on providers package --- pkg/apis/options/legacy_options.go | 9 ++++----- pkg/apis/options/options.go | 16 +++++----------- pkg/apis/options/providers.go | 19 ++++++++++++++----- 3 files changed, 23 insertions(+), 21 deletions(-) diff --git a/pkg/apis/options/legacy_options.go b/pkg/apis/options/legacy_options.go index 97d63d0d..b4f564d2 100644 --- a/pkg/apis/options/legacy_options.go +++ b/pkg/apis/options/legacy_options.go @@ -8,7 +8,6 @@ import ( "time" "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger" - "github.com/oauth2-proxy/oauth2-proxy/v7/providers" "github.com/spf13/pflag" ) @@ -552,9 +551,9 @@ func legacyProviderFlagSet() *pflag.FlagSet { flagSet.Bool("insecure-oidc-skip-nonce", true, "skip verifying the OIDC ID Token's nonce claim") flagSet.Bool("skip-oidc-discovery", false, "Skip OIDC discovery and use manually supplied Endpoints") flagSet.String("oidc-jwks-url", "", "OpenID Connect JWKS URL (ie: https://www.googleapis.com/oauth2/v3/certs)") - flagSet.String("oidc-groups-claim", providers.OIDCGroupsClaim, "which OIDC claim contains the user groups") - flagSet.String("oidc-email-claim", providers.OIDCEmailClaim, "which OIDC claim contains the user's email") - flagSet.StringSlice("oidc-audience-claim", providers.OIDCAudienceClaims, "which OIDC claims are used as audience to verify against client id") + flagSet.String("oidc-groups-claim", OIDCGroupsClaim, "which OIDC claim contains the user groups") + flagSet.String("oidc-email-claim", OIDCEmailClaim, "which OIDC claim contains the user's email") + flagSet.StringSlice("oidc-audience-claim", OIDCAudienceClaims, "which OIDC claims are used as audience to verify against client id") flagSet.StringSlice("oidc-extra-audience", []string{}, "additional audiences allowed to pass audience verification") flagSet.String("login-url", "", "Authentication endpoint") flagSet.String("redeem-url", "", "Token redemption endpoint") @@ -570,7 +569,7 @@ func legacyProviderFlagSet() *pflag.FlagSet { flagSet.String("jwt-key-file", "", "path to the private key file in PEM format used to sign the JWT so that you can say something like -jwt-key-file=/etc/ssl/private/jwt_signing_key.pem: required by login.gov") flagSet.String("pubjwk-url", "", "JWK pubkey access endpoint: required by login.gov") - flagSet.String("user-id-claim", providers.OIDCEmailClaim, "(DEPRECATED for `oidc-email-claim`) which claim contains the user ID") + flagSet.String("user-id-claim", OIDCEmailClaim, "(DEPRECATED for `oidc-email-claim`) which claim contains the user ID") flagSet.StringSlice("allowed-group", []string{}, "restrict logins to members of this group (may be given multiple times)") flagSet.StringSlice("allowed-role", []string{}, "(keycloak-oidc) restrict logins to members of these roles (may be given multiple times)") diff --git a/pkg/apis/options/options.go b/pkg/apis/options/options.go index 4a0feaf8..00dfbfb7 100644 --- a/pkg/apis/options/options.go +++ b/pkg/apis/options/options.go @@ -6,7 +6,6 @@ import ( ipapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/ip" internaloidc "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/oidc" - "github.com/oauth2-proxy/oauth2-proxy/v7/providers" "github.com/spf13/pflag" ) @@ -68,7 +67,6 @@ type Options struct { // internal values that are set after config validation redirectURL *url.URL - provider providers.Provider signatureData *SignatureData oidcVerifier *internaloidc.IDTokenVerifier jwtBearerVerifiers []*internaloidc.IDTokenVerifier @@ -77,7 +75,6 @@ type Options struct { // Options for Getting internal values func (o *Options) GetRedirectURL() *url.URL { return o.redirectURL } -func (o *Options) GetProvider() providers.Provider { return o.provider } func (o *Options) GetSignatureData() *SignatureData { return o.signatureData } func (o *Options) GetOIDCVerifier() *internaloidc.IDTokenVerifier { return o.oidcVerifier } func (o *Options) GetJWTBearerVerifiers() []*internaloidc.IDTokenVerifier { @@ -86,14 +83,11 @@ func (o *Options) GetJWTBearerVerifiers() []*internaloidc.IDTokenVerifier { func (o *Options) GetRealClientIPParser() ipapi.RealClientIPParser { return o.realClientIPParser } // Options for Setting internal values -func (o *Options) SetRedirectURL(s *url.URL) { o.redirectURL = s } -func (o *Options) SetProvider(s providers.Provider) { o.provider = s } -func (o *Options) SetSignatureData(s *SignatureData) { o.signatureData = s } -func (o *Options) SetOIDCVerifier(s *internaloidc.IDTokenVerifier) { o.oidcVerifier = s } -func (o *Options) SetJWTBearerVerifiers(s []*internaloidc.IDTokenVerifier) { - o.jwtBearerVerifiers = s -} -func (o *Options) SetRealClientIPParser(s ipapi.RealClientIPParser) { o.realClientIPParser = s } +func (o *Options) SetRedirectURL(s *url.URL) { o.redirectURL = s } +func (o *Options) SetSignatureData(s *SignatureData) { o.signatureData = s } +func (o *Options) SetOIDCVerifier(s *internaloidc.IDTokenVerifier) { o.oidcVerifier = s } +func (o *Options) SetJWTBearerVerifiers(s []*internaloidc.IDTokenVerifier) { o.jwtBearerVerifiers = s } +func (o *Options) SetRealClientIPParser(s ipapi.RealClientIPParser) { o.realClientIPParser = s } // NewOptions constructs a new Options with defaulted values func NewOptions() *Options { diff --git a/pkg/apis/options/providers.go b/pkg/apis/options/providers.go index 3eebbe46..a92764cf 100644 --- a/pkg/apis/options/providers.go +++ b/pkg/apis/options/providers.go @@ -1,6 +1,15 @@ package options -import "github.com/oauth2-proxy/oauth2-proxy/v7/providers" +const ( + // OIDCEmailClaim is the generic email claim used by the OIDC provider. + OIDCEmailClaim = "email" + + // OIDCGroupsClaim is the generic groups claim used by the OIDC provider. + OIDCGroupsClaim = "groups" +) + +// OIDCAudienceClaims is the generic audience claim list used by the OIDC provider. +var OIDCAudienceClaims = []string{"aud"} // Providers is a collection of definitions for providers. type Providers []Provider @@ -194,10 +203,10 @@ func providerDefaults() Providers { InsecureAllowUnverifiedEmail: false, InsecureSkipNonce: true, SkipDiscovery: false, - UserIDClaim: providers.OIDCEmailClaim, // Deprecated: Use OIDCEmailClaim - EmailClaim: providers.OIDCEmailClaim, - GroupsClaim: providers.OIDCGroupsClaim, - AudienceClaims: providers.OIDCAudienceClaims, + UserIDClaim: OIDCEmailClaim, // Deprecated: Use OIDCEmailClaim + EmailClaim: OIDCEmailClaim, + GroupsClaim: OIDCGroupsClaim, + AudienceClaims: OIDCAudienceClaims, ExtraAudiences: []string{}, }, },