From f07a5630f1138ce8364edda3de585a907c44d210 Mon Sep 17 00:00:00 2001 From: Nick Meves Date: Sat, 12 Dec 2020 13:50:34 -0800 Subject: [PATCH] Update Keycloak documentation --- CHANGELOG.md | 5 +++++ docs/docs/configuration/auth.md | 26 ++++++++++++++++++-------- providers/keycloak.go | 4 +--- 3 files changed, 24 insertions(+), 11 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index edb631d6..6af45d6a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,8 @@ ## Important Notes +- [#953](https://github.com/oauth2-proxy/oauth2-proxy/pull/953) Keycloak will now use `--profile-url` if set for the userinfo endpoint + instead of `--validate-url`. `--validate-url` will still work for backwards compatibility. - [#936](https://github.com/oauth2-proxy/oauth2-proxy/pull/936) `--user-id-claim` option is deprecated and replaced by `--oidc-email-claim` - [#630](https://github.com/oauth2-proxy/oauth2-proxy/pull/630) Gitlab projects needs a Gitlab application with the extra `read_api` enabled - [#849](https://github.com/oauth2-proxy/oauth2-proxy/pull/849) `/oauth2/auth` `allowed_groups` querystring parameter can be paired with the `allowed-groups` configuration option. @@ -33,6 +35,8 @@ ## Breaking Changes +- [#953](https://github.com/oauth2-proxy/oauth2-proxy/pull/953) In config files & envvar configs, `keycloak_group` is now the plural `keycloak_groups`. + Flag configs are still `--keycloak-group` but it can be passed multiple times. - [#911](https://github.com/oauth2-proxy/oauth2-proxy/pull/911) Specifying a non-existent provider will cause OAuth2-Proxy to fail on startup instead of defaulting to "google". - [#797](https://github.com/oauth2-proxy/oauth2-proxy/pull/797) Security changes to Google provider group authorization flow - If you change the list of allowed groups, existing sessions that now don't have a valid group will be logged out immediately. @@ -54,6 +58,7 @@ ## Changes since v6.1.1 +- [#953](https://github.com/oauth2-proxy/oauth2-proxy/pull/953) Migrate Keycloak to EnrichSession & support multiple groups for authorization (@NickMeves) - [#630](https://github.com/oauth2-proxy/oauth2-proxy/pull/630) Add support for Gitlab project based authentication (@factorysh) - [#907](https://github.com/oauth2-proxy/oauth2-proxy/pull/907) Introduce alpha configuration option to enable testing of structured configuration (@JoelSpeed) - [#938](https://github.com/oauth2-proxy/oauth2-proxy/pull/938) Cleanup missed provider renaming refactor methods (@NickMeves) diff --git a/docs/docs/configuration/auth.md b/docs/docs/configuration/auth.md index 7c5bac39..f16f2e26 100644 --- a/docs/docs/configuration/auth.md +++ b/docs/docs/configuration/auth.md @@ -135,15 +135,25 @@ If you are using GitHub enterprise, make sure you set the following to the appro Make sure you set the following to the appropriate url: - -provider=keycloak - -client-id= - -client-secret= - -login-url="http(s):///auth/realms//protocol/openid-connect/auth" - -redeem-url="http(s):///auth/realms//protocol/openid-connect/token" - -validate-url="http(s):///auth/realms//protocol/openid-connect/userinfo" - -keycloak-group= + --provider=keycloak + --client-id= + --client-secret= + --login-url="http(s):///auth/realms//protocol/openid-connect/auth" + --redeem-url="http(s):///auth/realms//protocol/openid-connect/token" + --profile-url="http(s):///auth/realms//protocol/openid-connect/userinfo" + --validate-url="http(s):///auth/realms//protocol/openid-connect/userinfo" + --keycloak-group= + --keycloak-group= + +For group based authorization, the optional `--keycloak-group` (legacy) or `--allowed-group` (global standard) +flags can be used to specify which groups to limit access to. -The group management in keycloak is using a tree. If you create a group named admin in keycloak you should define the 'keycloak-group' value to /admin. +If these are unset but a `groups` mapper is set up above in step (3), the provider will still +populate the `X-Forwarded-Groups` header to your upstream server with the `groups` data in the +Keycloak userinfo endpoint response. + +The group management in keycloak is using a tree. If you create a group named admin in keycloak +you should define the 'keycloak-group' value to /admin. ### GitLab Auth Provider diff --git a/providers/keycloak.go b/providers/keycloak.go index 66eda948..03d3194c 100644 --- a/providers/keycloak.go +++ b/providers/keycloak.go @@ -80,9 +80,7 @@ func (p *KeycloakProvider) EnrichSession(ctx context.Context, s *sessions.Sessio } groups, err := json.Get("groups").StringArray() - if err != nil { - logger.Errorf("Warning: unable to extract groups from userinfo endpoint: %v", err) - } else { + if err == nil { for _, group := range groups { if group != "" { s.Groups = append(s.Groups, group)