go/oauth2-proxy
1
0
Fork 0
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git synced 2026-06-19 22:58:30 +02:00
Code Issues Releases Activity
1,546 Commits 50 Branches 50 Tags
7a83d18f231a4d77c5e0a5b687694ad10f21b7a6
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Nick Meves ff914d7e17 Use ErrNotImplemented in default refresh implementation 2021-06-22 17:04:42 -07:00
Nick Meves baf6cf3816 Remove mutex from local Clock instances 
They will only be used in tests, but it doesn't play
nice with copy operations many tests use. The linter was
not happy. While the global clock needs mutexes for parallelism,
local Clocks only used it for Set/Add and didn't even use the
mutex for actual time functions.
 2021-06-22 17:04:42 -07:00
Nick Meves d91c3f867d Remove validation for invalid legacy v6.0.0 sessions 
The reflect.DeepCopy doesn't play nice with the new Lock and Clock
fields in sessions. And it added unneeded session deserialization
logic to every request.
 2021-06-22 17:04:42 -07:00
Nick Meves 593125152d Standarize provider refresh implemention & logging 2021-06-22 17:04:30 -07:00
Nick Meves 7fa6d2d024 Manage session time fields centrally 2021-06-21 21:54:52 -07:00
Nick Meves 7e80e5596b RefreshSessions immediately when called 2021-06-21 21:54:52 -07:00
Nick Meves 2dd4a9647a Update Changelog for release v7.1.3 2021-04-28 09:41:18 -07:00
Nick MevesandGitHub d6de11aa98 Merge pull request #1168 from oauth2-proxy/metrics-tls-flag-fix 
Fix Metrics cfg option naming typo
 2021-04-27 10:15:46 -07:00
Nick Meves 544ba2a21c Fix Metrics cfg option naming typo 2021-04-23 13:24:28 -07:00
Nick MevesandGitHub 7eeaea0b3f Support nonce checks in OIDC Provider (#967) 
* Set and verify a nonce with OIDC

* Create a CSRF object to manage nonces & cookies

* Add missing generic cookie unit tests

* Add config flag to control OIDC SkipNonce

* Send hashed nonces in authentication requests

* Encrypt the CSRF cookie

* Add clarity to naming & add more helper methods

* Make CSRF an interface and keep underlying nonces private

* Add ReverseProxy scope to cookie tests

* Align to new 1.16 SameSite cookie default

* Perform SecretBytes conversion on CSRF cookie crypto

* Make state encoding signatures consistent

* Mock time in CSRF struct via Clock

* Improve InsecureSkipNonce docstring
 2021-04-21 10:33:27 +01:00
Nick MevesandGitHub d3423408c7 Add a clock package for better time mocking (#1136) 
* Add a clock package for better time mocking

* Make Clock a struct so it doesn't need initialization

* Test clock package

* Use atomic for live time tests

* Refer to same clock.Mock throughout methods
 2021-04-18 18:25:57 +01:00
Nick Meves 05c3fa7601 Fix GitLab CVE test case 2021-03-25 10:29:17 -07:00
Nick MevesGitHubWilfried OLLIVIER
 		0279fa7dff Merge pull request from GHSA-652x-m2gr-hppm 
* Populate session Groups from userinfo response

* Fix: gitlab tests

Co-authored-by: Wilfried OLLIVIER <wollivier@bearstech.com>
 2021-03-25 17:20:45 +00:00
Nick MevesandGitHub c1267bb92d Request ID Logging (#1087) 
* Add RequestID to the RequestScope

* Expose RequestID to auth & request loggers

* Use the RequestID in templated HTML pages

* Allow customizing the RequestID header

* Document new Request ID support

* Add more cases to scope/requestID tests

* Split Get vs Generate RequestID funtionality

* Add {{.RequestID}} to the request logger tests

* Move RequestID management to RequestScope

* Use HTML escape instead of sanitization for Request ID rendering
 2021-03-21 18:20:57 +00:00
Nick MevesandGitHub 4d9de06b1d Deprecate GAP-Signature and add a warning on usage (#1103) 2021-03-14 09:47:44 -07:00
Nick MevesandGitHub 602dac7852 Move Logging to Middleware Package (#1070) 
* Use a specialized ResponseWriter in middleware

* Track User & Upstream in RequestScope

* Wrap responses in our custom ResponseWriter

* Add tests for logging middleware

* Inject upstream metadata into request scope

* Use custom ResponseWriter only in logging middleware

* Assume RequestScope is never nil
 2021-03-06 17:27:16 +00:00
Nick MevesandGitHub c9d9769f6f Merge pull request #1026 from oauth2-proxy/fix-flag-loading 
Ensure config flags get parsed correctly when other flags preceed them
 2021-02-06 14:49:45 -08:00
Nick Meves c3f31b4dd5 Flatten array-based response headers 2021-02-03 16:48:26 -08:00
Nick MevesandGitHub 780ae4f3c9 Merge pull request from GHSA-4mf2-f3wh-gvf2 2021-02-01 18:04:33 +00:00
Nick Meves da02914a9c Log IsValidRedirect violations and do a final safety call 2021-01-16 13:56:38 -08:00
Nick Meves fa6a785eaf Improve handler vs helper organization in oauthproxy.go 
Additionally, convert a lot of helper methods to be private
 2021-01-16 13:55:49 -08:00
Nick Meves 73fc7706bc Figure out final app redirect URL with proxy aware request utils 2021-01-16 13:55:49 -08:00
Nick Meves f054682fb7 Make HTTPS Redirect middleware Reverse Proxy aware 2021-01-16 13:55:48 -08:00
Nick Meves 6fb3274ca3 Refactor organization of scope aware request utils 
Reorganized the structure of the Request Utils due to their widespread use
resulting in circular imports issues (mostly because of middleware & logger).
 2021-01-16 13:55:48 -08:00
Nick Meves b625de9490 Track the ReverseProxy option in the request Scope 
This allows for proper handling of reverse proxy based headers throughout
the lifecycle of a request.
 2021-01-16 13:55:48 -08:00
Nick MevesandGitHub 8e02fac2cc Merge pull request #995 from oauth2-proxy/security 
Add Security Policy
 2021-01-16 13:54:07 -08:00
Nick MevesandGitHub a0d37518e0 Merge pull request #989 from rassie/master 
Adapt isAjax to support mimetype lists
 2021-01-12 15:28:07 -08:00
Nick Meves d08b9b7cc4 Add NickMeves to MAINTAINERS 2021-01-10 10:56:01 -08:00
Nick Meves 4b28e6886c Handle ValidateURL fallback for nil & empty struct cases 2020-12-24 14:04:20 -08:00
Nick Meves 816d9a4566 Use a generic http.HandlerFunc in Keycloak tests 2020-12-24 14:04:19 -08:00
Nick Meves f07a5630f1 Update Keycloak documentation 2020-12-24 14:04:19 -08:00
Nick Meves 138a6b128a Use ProfileURL for userinfo EnrichSession calls in Keycloak 2020-12-24 14:04:19 -08:00
Nick Meves 0886f8035c Move all Keycloak unit tests to Ginkgo 2020-12-24 14:04:19 -08:00
Nick Meves 3369799853 Migrate Keycloak to EnrichSession & support multiple groups 2020-12-24 14:04:19 -08:00
Nick MevesandGitHub 89e0a77a8f Merge pull request #849 from grnhse/is-831-auth-querystring-groups 
Group/Role Access Restriction support in `/oauth2/auth` endpoint
 2020-12-24 12:21:40 -08:00
Nick Meves 753f6c548a Add a detailed allowed_groups example to Important Notes 2020-12-24 12:05:12 -08:00
Nick Meves 65e15f24c1 Support only allowed_groups querystring 2020-12-24 12:05:12 -08:00
Nick Meves 025056cba0 Move AuthOnly authorize logic to a dedicated method 2020-12-24 12:05:11 -08:00
Nick Meves 44d83e5f95 Use StatusForbidden to prevent infinite redirects 2020-12-24 12:04:01 -08:00
Nick Meves 23b2355f85 Allow group authZ in AuthOnly endpoint via Querystring 2020-12-24 12:04:01 -08:00
Nick Meves d2ffef2c7e Use global OIDC fields for Gitlab 2020-12-21 16:54:12 -08:00
Nick Meves 42f6cef7d6 Improve OIDC error handling 2020-12-21 16:53:05 -08:00
Nick Meves ea5b8cc21f Support non-list and complex groups 2020-12-21 16:52:18 -08:00
Nick Meves eb56f24d6d Deprecate UserIDClaim in config and docs 2020-12-21 16:52:17 -08:00
Nick Meves 74ac4274c6 Move generic OIDC functionality to be available to all providers 2020-12-21 16:52:04 -08:00
Nick Meves a1877434b2 Refactor OIDC to EnrichSession 2020-12-21 16:51:52 -08:00
Nick Meves 26ed080bed Cleanup method name refactors missed in comments 2020-11-29 14:18:14 -08:00
Nick MevesandGitHub f6ae15e8c3 Merge pull request #869 from grnhse/streamline-provider-naming 
Streamline Provider Interface & Bearer Session Handlers
 2020-11-28 10:30:09 -08:00
Nick Meves 57a8ef06b4 Fix method renaming in comments and tests 2020-11-28 10:25:12 -08:00
Nick Meves 5f8f856260 Remove failed bearer tokens from logs 2020-11-28 10:25:12 -08:00
Nick Meves 22f60e9b63 Generalize and extend default CreateSessionFromToken 2020-11-28 10:25:12 -08:00
Nick Meves 44fa8316a1 Aggregate error logging on JWT chain failures 2020-11-28 10:25:12 -08:00
Nick Meves 3e9717d489 Decouple TokenToSession from OIDC & add a generic VerifyFunc 2020-11-28 10:25:11 -08:00
Nick Meves e9f787957e Standardize provider interface method names 2020-11-28 10:25:11 -08:00
Nick Meves 7407fbd3a7 Add more UserInfo test cases 2020-11-25 19:00:58 -08:00
Nick Meves 2549b722d3 Add User & Groups to Userinfo 2020-11-25 18:19:48 -08:00
Nick MevesandGitHub 3ff0c23a9e Merge pull request #931 from apeschel/topic/stable-repo-url-fix 
Use New Stable Chart URL
 2020-11-24 20:57:28 -08:00
Nick Meves d7fa979060 Note legacy areas to refactor away from groupValidator 2020-11-12 11:18:59 -08:00
Nick Meves b9661cb6fe Return 401 Unauthorized if Authorize fails 2020-11-12 11:18:59 -08:00
Nick Meves f21b3b8b20 Authorize in Redeem callback flow 2020-11-12 11:18:59 -08:00
Nick Meves 1b3b00443a Streamline ErrMissingCode in provider Redeem methods 2020-11-12 11:18:59 -08:00
Nick Meves b92fd4b0bb Streamline Google to use default Authorize 2020-11-12 11:18:58 -08:00
Nick Meves eb58ea2ed9 Move AllowedGroups to DefaultProvider for default Authorize usage 2020-11-12 11:18:15 -08:00
Nick Meves e7ac793044 Replace ValidateGroup with Authorize for Provider 2020-11-12 11:17:06 -08:00
Nick Meves 2b15ba0bcf Remove v5 JSON session support 2020-11-08 08:52:55 -08:00
Nick Meves 7d6ff03d13 Fix X-Auth-Request-Preferred-Username in response headers 2020-11-07 12:47:42 -08:00
Nick Meves 1c26539ef0 Align tests to SkipAuthStripHeaders default 2020-11-07 12:33:37 -08:00
Nick Meves 14fd934b32 Flip --skip-auth-strip-headers to true by default 2020-11-07 11:43:45 -08:00
Nick MevesandGitHub 5cba642938 Merge pull request #826 from oauth2-proxy/header-middlewares 
Integrate new header injectors into project
 2020-11-07 11:14:31 -08:00
Nick Meves 4a54c9421c Remove EmailDomain verification from GitLab provider 
This is handled globally
 2020-10-20 10:01:53 -07:00
Nick Meves d9c141ae7c Remove GetUserName method from Provider 2020-10-19 14:09:46 -07:00
Nick Meves 0da45e97e1 Refactor GitLab to EnrichSessionState 2020-10-19 14:09:45 -07:00
Nick Meves e51f5fe7c9 Refactor GitHub to EnrichSessionState 2020-10-19 14:09:45 -07:00
Nick Meves 2b9e1bbba0 Add EnrichSessionState as main post-Redeem session updater 2020-10-19 14:09:45 -07:00
Nick Meves b6061f0803 Adds tests for redeemCode and enrichSession 2020-10-19 14:09:02 -07:00
Nick Meves 0bd8eb3191 Setup provider.ErrNotImplemented sentinel error 2020-10-19 14:09:02 -07:00
Nick Meves add45c360c Split session enrichment from code redemption 2020-10-19 14:09:02 -07:00
Nick MevesandGitHub f4c292b6c7 Merge pull request #825 from oauth2-proxy/test-reporter 
Fix code coverage reporting on GitHub actions
 2020-10-13 17:16:53 -07:00
Nick Meves b7b7ade7c4 Improve AllowedRoute test table formatting 2020-10-07 10:13:41 -07:00
Nick Meves 89a8ac8c1f Add startup logging for skipped auth routes 2020-10-07 10:13:41 -07:00
Nick Meves fa4ba5e7ea Convert allowlist validation test to Ginkgo 2020-10-07 10:13:41 -07:00
Nick Meves cfd3de807c Add tests for skip auth functionality 2020-10-07 10:13:41 -07:00
Nick Meves 183cb124a4 Support HTTP method based allowlists 2020-10-07 10:13:40 -07:00
Nick MevesandGitHub 7c4479791c Merge pull request #753 from codablock/azure-resource 
Pass resource parameter in login url
 2020-09-29 09:21:14 -07:00
Nick Meves e0d915cc03 Stop shadowing GetEmailAddress errors in redeemCode 2020-09-24 10:50:18 -07:00
Nick Meves 3371284a36 Remove GetPreferredUsername method from Provider interface 
It isn't used in any providers and we have future plans
to remove the specialness of PreferredUsername and make it
an optional field in the session.

User, Email & Groups will eventually be the only first class
fields on the session that are always set.
 2020-09-24 10:49:50 -07:00
Nick Meves 6db1aeb9c6 Validate Redis session store health on startup 2020-09-24 10:41:43 -07:00
Nick Meves 56f199a24f Stop accepting legacy SHA1 signed cookies 2020-09-24 10:31:34 -07:00
Nick MevesandGitHub 55a941b76e Merge pull request #788 from blz-ea/patch-1 
docs: fix Keycloak provider documentation
 2020-09-23 09:54:40 -07:00
Nick MevesandGitHub 8eb9c69a9a Merge pull request #616 from stefansedich/group-claim 
Add support to ensure user belongs in required groups when using the OIDC provider
 2020-09-21 13:04:27 -07:00
Nick Meves 29b24793e3 Use X-Forwarded-Host consistently 2020-08-31 08:31:45 -07:00
Nick Meves 0645e19c24 Cleanup internalSession params & handle profileURL Bearer case better 
`findClaimsFromIDToken` would always have a `nil` access token and not be
able to hit the userinfo endpoint in Bearer case. If access token is nil,
default to legacy `session.Email = claim.Subject` that all JWT bearers used
to have, even if a valid profileURL is present.
 2020-08-14 13:31:38 -07:00
Nick Meves dcc75410a8 Handle claim finding differently in bearer vs standard IDTokens 2020-08-14 13:31:38 -07:00
Nick Meves 514db45d1a Allow OIDC Bearer Tokens without emails 
This reverts to functionality before #499 where an OIDC
provider could be used with `--skip-jwt-bearer-tokens` and
tokens without an email or profileURL would still be valid.
This logic mirrors `middleware.createSessionStateFromBearerToken`
which used to be the universal logic before #499.
 2020-08-14 13:31:38 -07:00
Nick Meves 51a9062044 Support Password & SentinelPassword in Redis session store 2020-08-11 12:22:05 -07:00
Nick MevesandGitHub 35ed7a313b Merge pull request #719 from grnhse/gosec-x-oauth-basic-skip 
Add `x-oauth-basic` nosec annotation & address gosec unhandled errors
 2020-08-11 11:56:07 -07:00
Nick Meves b6e78efc1e Add x-oauth-basic nosec annotation & address gosec unhandled errors 2020-08-10 15:15:16 -07:00
Nick MevesandGitHub 33e04cc52f Merge pull request #690 from grnhse/gosec-findings-fixes 
Address gosec findings
 2020-08-09 08:24:37 -07:00
Nick Meves a1358d2070 Panic on any logger errors 
Any template errors instead of IO
errors are caught in validation.
 2020-08-09 07:55:41 -07:00
Nick Meves e88d29f16a Refactor SignInMessage out of main 2020-08-09 07:55:41 -07:00