git.iko.soy/typeable/oauth2-proxy
on f8ddc13 help sign in
typeable/oauth2-proxy/pkg/validation/options.go
185 lines 6.4 kB history raw
1package validation
3import (
4 "context"
5 "crypto/tls"
6 "fmt"
7 "net/http"
8 "net/url"
9 "strings"
11 "github.com/mbland/hmacauth"
12 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
13 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/ip"
14 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
15 internaloidc "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/providers/oidc"
16 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util"
19// Validate checks that required options are set and validates those that they
20// are of the correct format
21func Validate(o *options.Options) error {
22 msgs := validateCookie(o.Cookie)
23 msgs = append(msgs, validateSessionCookieMinimal(o)...)
24 msgs = append(msgs, validateRedisSessionStore(o)...)
25 msgs = append(msgs, prefixValues("injectRequestHeaders: ", validateHeaders(o.InjectRequestHeaders)...)...)
26 msgs = append(msgs, prefixValues("injectResponseHeaders: ", validateHeaders(o.InjectResponseHeaders)...)...)
27 msgs = append(msgs, validateProviders(o)...)
28 msgs = configureLogger(o.Logging, msgs)
29 msgs = parseSignatureKey(o, msgs)
31 if o.SSLInsecureSkipVerify {
32 // InsecureSkipVerify is a configurable option we allow
33 /* #nosec G402 */
34 insecureTransport := &http.Transport{
35 TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
36 }
37 http.DefaultClient = &http.Client{Transport: insecureTransport}
38 } else if len(o.Providers[0].CAFiles) > 0 {
39 pool, err := util.GetCertPool(o.Providers[0].CAFiles)
40 if err == nil {
41 transport := http.DefaultTransport.(*http.Transport).Clone()
42 transport.TLSClientConfig = &tls.Config{
43 RootCAs: pool,
44 MinVersion: tls.VersionTLS12,
45 }
47 http.DefaultClient = &http.Client{Transport: transport}
48 } else {
49 msgs = append(msgs, fmt.Sprintf("unable to load provider CA file(s): %v", err))
50 }
51 }
53 if o.AuthenticatedEmailsFile == "" && len(o.EmailDomains) == 0 && o.HtpasswdFile == "" {
54 msgs = append(msgs, "missing setting for email validation: email-domain or authenticated-emails-file required."+
55 "\n use email-domain=* to authorize all email addresses")
56 }
58 if o.SkipJwtBearerTokens {
59 // Configure extra issuers
60 if len(o.ExtraJwtIssuers) > 0 {
61 var jwtIssuers []jwtIssuer
62 jwtIssuers, msgs = parseJwtIssuers(o.ExtraJwtIssuers, msgs)
63 for _, jwtIssuer := range jwtIssuers {
64 verifier, err := newVerifierFromJwtIssuer(
65 o.Providers[0].OIDCConfig.AudienceClaims,
66 o.Providers[0].OIDCConfig.ExtraAudiences,
67 jwtIssuer,
68 )
69 if err != nil {
70 msgs = append(msgs, fmt.Sprintf("error building verifiers: %s", err))
71 }
72 o.SetJWTBearerVerifiers(append(o.GetJWTBearerVerifiers(), verifier))
73 }
74 }
75 }
77 var redirectURL *url.URL
78 redirectURL, msgs = parseURL(o.RawRedirectURL, "redirect", msgs)
79 o.SetRedirectURL(redirectURL)
80 if o.RawRedirectURL == "" && !o.Cookie.Secure && !o.ReverseProxy {
81 logger.Print("WARNING: no explicit redirect URL: redirects will default to insecure HTTP")
82 }
84 msgs = append(msgs, validateUpstreams(o.UpstreamServers)...)
86 if o.ReverseProxy {
87 parser, err := ip.GetRealClientIPParser(o.RealClientIPHeader)
88 if err != nil {
89 msgs = append(msgs, fmt.Sprintf("real_client_ip_header (%s) not accepted parameter value: %v", o.RealClientIPHeader, err))
90 }
91 o.SetRealClientIPParser(parser)
93 // Allow the logger to get client IPs
94 logger.SetGetClientFunc(func(r *http.Request) string {
95 return ip.GetClientString(o.GetRealClientIPParser(), r, false)
96 })
97 }
99 // Do this after ReverseProxy validation for TrustedIP coordinated checks
100 msgs = append(msgs, validateAllowlists(o)...)
102 if len(msgs) != 0 {
103 return fmt.Errorf("invalid configuration:\n %s",
104 strings.Join(msgs, "\n "))
105 }
106 return nil
109func parseSignatureKey(o *options.Options, msgs []string) []string {
110 if o.SignatureKey == "" {
111 return msgs
112 }
114 logger.Print("WARNING: `--signature-key` is deprecated. It will be removed in a future release")
116 components := strings.Split(o.SignatureKey, ":")
117 if len(components) != 2 {
118 return append(msgs, "invalid signature hash:key spec: "+
119 o.SignatureKey)
120 }
122 algorithm, secretKey := components[0], components[1]
123 hash, err := hmacauth.DigestNameToCryptoHash(algorithm)
124 if err != nil {
125 return append(msgs, "unsupported signature hash algorithm: "+o.SignatureKey)
126 }
127 o.SetSignatureData(&options.SignatureData{Hash: hash, Key: secretKey})
128 return msgs
131// parseJwtIssuers takes in an array of strings in the form of issuer=audience
132// and parses to an array of jwtIssuer structs.
133func parseJwtIssuers(issuers []string, msgs []string) ([]jwtIssuer, []string) {
134 parsedIssuers := make([]jwtIssuer, 0, len(issuers))
135 for _, jwtVerifier := range issuers {
136 components := strings.Split(jwtVerifier, "=")
137 if len(components) < 2 {
138 msgs = append(msgs, fmt.Sprintf("invalid jwt verifier uri=audience spec: %s", jwtVerifier))
139 continue
140 }
141 uri, audience := components[0], strings.Join(components[1:], "=")
142 parsedIssuers = append(parsedIssuers, jwtIssuer{issuerURI: uri, audience: audience})
143 }
144 return parsedIssuers, msgs
147// newVerifierFromJwtIssuer takes in issuer information in jwtIssuer info and returns
148// a verifier for that issuer.
149func newVerifierFromJwtIssuer(audienceClaims []string, extraAudiences []string, jwtIssuer jwtIssuer) (internaloidc.IDTokenVerifier, error) {
150 pvOpts := internaloidc.ProviderVerifierOptions{
151 AudienceClaims: audienceClaims,
152 ClientID: jwtIssuer.audience,
153 ExtraAudiences: extraAudiences,
154 IssuerURL: jwtIssuer.issuerURI,
155 }
157 pv, err := internaloidc.NewProviderVerifier(context.TODO(), pvOpts)
158 if err != nil {
159 // If the discovery didn't work, try again without discovery
160 pvOpts.JWKsURL = strings.TrimSuffix(jwtIssuer.issuerURI, "/") + "/.well-known/jwks.json"
161 pvOpts.SkipDiscovery = true
163 pv, err = internaloidc.NewProviderVerifier(context.TODO(), pvOpts)
164 if err != nil {
165 return nil, fmt.Errorf("could not construct provider verifier for JWT Issuer: %v", err)
166 }
167 }
169 return pv.Verifier(), nil
172// jwtIssuer hold parsed JWT issuer info that's used to construct a verifier.
173type jwtIssuer struct {
174 issuerURI string
175 audience string
178func parseURL(toParse string, urltype string, msgs []string) (*url.URL, []string) {
179 parsed, err := url.Parse(toParse)
180 if err != nil {
181 return nil, append(msgs, fmt.Sprintf(
182 "error parsing %s-url=%q %s", urltype, toParse, err))
183 }
184 return parsed, msgs