go/oauth2-proxy
1
0
Fork 0
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git synced 2025-04-27 12:32:10 +02:00
Code Issues Releases Activity

Handle UPN fallback when profileURL isn't set

Browse Source
This commit is contained in:
Nick Meves 2021-07-03 13:40:34 -07:00
parent 1621ea3bba
commit bdfca925a3
2 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
providers/adfs.go
View File

@ -84,11 +84,8 @@ func (p *ADFSProvider) GetLoginURL(redirectURI, state, nonce string) string {
// from the claims. If Email is missing, falls back to ADFS `upn` claim. // from the claims. If Email is missing, falls back to ADFS `upn` claim.
func (p *ADFSProvider) EnrichSession(ctx context.Context, s *sessions.SessionState) error { func (p *ADFSProvider) EnrichSession(ctx context.Context, s *sessions.SessionState) error {
err := p.oidcEnrichFunc(ctx, s) err := p.oidcEnrichFunc(ctx, s)
if err != nil { if err != nil || s.Email == "" {
return err // OIDC only errors if email is missing
}
if s.Email == "" {
return p.fallbackUPN(ctx, s) return p.fallbackUPN(ctx, s)
} }
return nil return nil

11
providers/adfs_test.go
View File

@ -5,6 +5,7 @@ import (
"crypto/rand" "crypto/rand"
"crypto/rsa" "crypto/rsa"
"encoding/base64" "encoding/base64"
"errors"
"net/http" "net/http"
"net/http/httptest" "net/http/httptest"
"net/url" "net/url"
@ -253,6 +254,16 @@ var _ = Describe("ADFS Provider Tests", func() {
Expect(err).ToNot(HaveOccurred()) Expect(err).ToNot(HaveOccurred())
Expect(session.Email).To(Equal("upn@company.com")) Expect(session.Email).To(Equal("upn@company.com"))
}) })
It("falls back to UPN claim on errors", func() {
p.oidcEnrichFunc = func(_ context.Context, s *sessions.SessionState) error {
return errors.New("neither the id_token nor the profileURL set an email")
}
err := p.EnrichSession(context.Background(), session)
Expect(err).ToNot(HaveOccurred())
Expect(session.Email).To(Equal("upn@company.com"))
})
}) })
Describe("RefreshSession", func() { Describe("RefreshSession", func() {