go/oauth2-proxy
1
0
Fork 0
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git synced 2025-12-19 23:52:17 +02:00
Code Issues Releases Activity

feat: add allowed_* constraint option to proxy endpoint query string (#2841)

Browse Source 
* Add check for constraints to the proxy endpoint

* Add tests for allowed_groups query string

* Add this feature to the changelog

* Apply suggestions from code review

Co-authored-by: Jan Larwig <jan@larwig.com>

* Use explicit key names in TestProxyAllowedGroups

* Document the query parameters on proxy endpoint

* Comment was copied from the AuthOnly handler but on closer inspection is not relevant here
replacing comment with one more relevant

---------

Signed-off-by: Jan Larwig <jan@larwig.com>
Co-authored-by: Jan Larwig <jan@larwig.com>
This commit is contained in:
Jacob Alberty
2025-11-08 06:58:34 -06:00
committed by GitHub
parent 22053dcade
commit fcc2db040e
4 changed files with 88 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

73
oauthproxy_test.go
View File

@@ -2938,12 +2938,75 @@ func TestProxyAllowedGroups(t *testing.T) {
name string
allowedGroups []string
groups []string
querystring string
expectUnauthorized bool
}{
{"NoAllowedGroups", []string{}, []string{}, false},
{"NoAllowedGroupsUserHasGroups", []string{}, []string{"a", "b"}, false},
{"UserInAllowedGroup", []string{"a"}, []string{"a", "b"}, false},
{"UserNotInAllowedGroup", []string{"a"}, []string{"c"}, true},
{
name: "NoAllowedGroups",
allowedGroups: []string{},
groups: []string{},
querystring: "",
expectUnauthorized: false},
{
name: "NoAllowedGroupsUserHasGroups",
allowedGroups: []string{},
groups: []string{"a", "b"},
querystring: "",
expectUnauthorized: false},
{
name: "UserInAllowedGroup",
allowedGroups: []string{"a"},
groups: []string{"a", "b"},
querystring: "",
expectUnauthorized: false},
{
name: "UserNotInAllowedGroup",
allowedGroups: []string{"a"},
groups: []string{"c"},
querystring: "",
expectUnauthorized: true},
{
name: "UserInQuerystringGroup",
allowedGroups: []string{"a", "b"},
groups: []string{"a", "c"},
querystring: "?allowed_groups=a",
expectUnauthorized: false},
{
name: "UserInMultiParamQuerystringGroup",
allowedGroups: []string{"a", "b"},
groups: []string{"b"},
querystring: "?allowed_groups=a&allowed_groups=b,d",
expectUnauthorized: false},
{
name: "UserInOnlyQuerystringGroup",
allowedGroups: []string{},
groups: []string{"a", "c"},
querystring: "?allowed_groups=a,b",
expectUnauthorized: false},
{
name: "UserInDelimitedQuerystringGroup",
allowedGroups: []string{"a", "b", "c"},
groups: []string{"c"},
querystring: "?allowed_groups=a,c",
expectUnauthorized: false},
{
name: "UserNotInQuerystringGroup",
allowedGroups: []string{},
groups: []string{"c"},
querystring: "?allowed_groups=a,b",
expectUnauthorized: true},
{
name: "UserInConfigGroupNotInQuerystringGroup",
allowedGroups: []string{"a", "b", "c"},
groups: []string{"c"},
querystring: "?allowed_groups=a,b",
expectUnauthorized: true},
{
name: "UserInQuerystringGroupNotInConfigGroup",
allowedGroups: []string{"a", "b"},
groups: []string{"c"},
querystring: "?allowed_groups=b,c",
expectUnauthorized: true},
}
for _, tt := range tests {
@@ -2979,7 +3042,7 @@ func TestProxyAllowedGroups(t *testing.T) {
t.Fatal(err)
}
test.req, _ = http.NewRequest("GET", "/", nil)
test.req, _ = http.NewRequest("GET", fmt.Sprintf("/%s", tt.querystring), nil)
test.req.Header.Add("accept", applicationJSON)
err = test.SaveSession(session)